Vulnerability · Published Sep 17, 2025 · Assigned by JFROG

CVE-2025-10157PickleScan Bypasses Unsafe Globals Check Using Submodule Imports

Critical 9.3

In plain English

A critical-severity security flaw in picklescan from mmaitre314. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.8%top 43.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodules of dangerous packages (e.g., 'asyncio.unix_events' instead of 'asyncio'). When the incorrectly considered safe file is loaded after scan, it can lead to the execution of malicious code.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	picklescan	0.0.31	GHSA-f7qq-56ww-84cr
PyPI	picklescan	0.0.31	PYSEC-2025-153

Affected products (as reported)

Vendor	Product	Versions
mmaitre314	picklescan	0 – through 0.0.30

Weakness: CWE-693 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

GitHub Security Advisory vendor-advisory, exploit
Proof of Concept (Malicious Pickle) exploit
Vulnerable Code